Legal Issues Concerning Identifiable Health Data Sharing Between State/ Local Public Health Authorities and Tribal Epidemiology Centers in Selected U.S. Jurisdictions A r e p o r t f o r t h e Council of State and Territorial Epidemiologists (CSTE) James G. Hodge, Jr., JD, LL M Professor, Johns Hopkins Bloomberg School of Public Health Executive Director, Centers for Law and the Public’s Health Torrey Kaufman, JD, MPH Georgetown and Johns Hopkins Universities Researcher, Centers for Law and the Public’s Health Craig Jaques, BA Research Assistant, Centers for Law and the Public’s Health Original Draft as of March 30, 2009; Revised by CSTE (with author overview) as of November 8, 2011 Table of Contents Acknowledgement .................................................................................................................... i Table of Abbreviations ............................................................................................................ ii I. Introduction .................................................................................................................. 1 II. Tribal Epidemiology Centers—Brief Overview ........................................................... 3 Figure 1. Tribal and Urban Epidemiology Centers, United States ................................... 3 III. Health Information Privacy, Confidentiality, and Security ......................................... 4 A. Privacy, Confidentiality, and Security .............................................................................. 4 B. Identifiable versus Nonidentifiable Health Data ............................................................... 5 C. Balancing Individual and Communal Interests ................................................................ 6 D. Distinguishing Public Health Practice and Human Subjects Research ............................ 6 IV. Privacy Laws and Policies Concerning the Acquisition, Use, and Disclosure of Identifiable Health Data ................................................................................................ 8 A. Constitutional Health Information Privacy Protections ..................................................... 9 B. Federal Health Information Privacy Protections .............................................................. 9 C. State Health Information Privacy Protections .................................................................11 D. State Laws Concerning Data Sharing Between TECs and State or Local Public Health Agencies ...................................................................................................................13 V. Health Information Privacy Challenges Concerning Data Sharing Between State/Local Health Departments and TECs ................................................................15 A. Justifying Public Health Data Acquisitions .....................................................................16 B. Specifying Legal Authority to Acquire Data ....................................................................16 C. Use of Nonidentifiable Data ...........................................................................................16 D. Protecting Identifiable Information through Data-Protection Agreements .......................17 E. Clarification of Public Health Practice and Research Uses for Identifiable Data .............17 F. Additional State-specific Recommendations ..................................................................18 VI. Conclusion ...................................................................................................................19 Table 1. Legal Issues Concerning Identifiable Data Sharing Between State/Local Public Health Authorities and Tribal Epidemiology Centers in Selected States ................21 Table 2. Summary of Legal Issues Concerning Identifiable Data Sharing Between State/Local Public Health Authorities and Tribal Epidemiology Centers in Selected States ...........................................................................................................................29 Notes and References ............................................................................................................30 Acknowledgement1 The authors at the Center for Law and the Public’s Health: A Collaborative at Johns Hopkins and Georgetown Universities acknowledge Evan D. Anderson, J.D., Center Senior Fellow, and P.J. Wakefield, Center Administrator, for their research, editing, formatting, and other contributions to this report. The authors would also like to acknowledge the CSTE Tribal Epidemiology Workgroup for its contributions in reviewing and revising this document, specifically Edward Chao, Jessica Craig, John Mosley Hayes, Michael Landen, Jennifer Lemmings, Zeenat Mahal, and Annie Tran. While the lead author (James G. Hodge, Jr.) has reviewed edits to this report made by CSTE following its original version on March 30, 2009, the authors have not conducted additional legal research to verify specific edits made by CSTE, particularly related to Tables 1 and 2. This publication was supported by Cooperative Agreement Number 5U38HM000414-04. Its contents are solely the responsibility of the authors and do not necessarily represent the official views of CDC. i Table of Abbreviations Abbrev. Term or Title AI/AN American Indian/Alaska Native AIDS Acquired immunodeficiency syndrome CDC Centers for Disease Control and Prevention CSTE Council of State and Territorial Epidemiologists DHHS Department of Health and Human Services FERPA Family Education Rights and Privacy Act FOIA Freedom of Information Act HIPAA Health Insurance Portability and Accountability Act IHCIA Indian Health Care Improvement Act HIV Human immunodeficiency virus IHS Indian Health Service IRB Institutional Review Board MSPHPA Model State Public Health Privacy Act MVSRA Model Vital Statistics and Regulations Act OSHA Occupational Safety and Health Administration PHI Protected Health Information TEC Tribal Epidemiology Center ii I. Introduction Identifiable health data are the lifeblood of public health surveillance and other activities. Their use is essential to effective public health activities and public health research. Public health authorities at all levels of government seek increasingly greater types and volume of personally identifiable health information, including through data exchanges between public health entities. Too often, however, acquisition and use of identifiable health information through existing public health databases are restricted or limited by privacy norms or other policies. Public health authorities might be reticent to share identifiable health data, even for legitimate public health purposes, because of concerns about individual privacy or legal interpretations of privacy laws. As a result, public health entities can lack access to health data to conduct essential services and research. Although the veracity of this observation extends to multiple data-sharing practices, tribal public health authorities such as Tribal Epidemiology Centers (TECs) nationally have reported extensive limitations concerning data sharing with state or local public health authorities. Funded by the U.S. Indian Health Service (IHS), the nation’s 12 TECs work in partnership with tribal governments or tribal government coalitions. Each TEC is designated to serve the American Indian/Alaska Native (AI/AN) population within one of the 12 IHS administrative areas, although one TEC serves two IHS areas and another TEC serves urban AI/AN populations throughout the nation. TECs rely on the sharing of existing public health data accumulated by federal, state, or local governments to conduct a variety of epidemiologic activities to improve tribal health. In March 2010, the Indian Health Care Improvement Act (IHCIA) was permanently reauthorized and required that TECs be treated as public health authorities for purposes of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. At a meeting in Albuquerque in May 2008, the CSTE Tribal Epidemiology Subcommittee identified a series of action items and recommendations to improve public health surveillance in Indian Country. Among these recommendations is the need to better understand and encourage data sharing between TECs and state health departments. On the basis of reports from the field discussed during this meeting, TEC authorities consistently face hindrances in gaining access to state/local public health data. These barriers to data sharing predominately originate from privacy-related concerns among state/local authorities in releasing identifiable heath data to tribal entities. In November 2008, CSTE asked the Centers for Law and the Public’s Health: A Collaborative at Johns Hopkins and Georgetown Universities to research and assess state laws in a geographically representative sample of states with federally recognized tribes, specifically Arizona, Florida, Maine, Nevada, Oklahoma, South Dakota, and Washington, concerning the following legal question: What state-specific laws (e.g., statutes, regulations, cases) authorize or limit the sharing of identifiable public health data between state public health authorities and TECs for lawful public health activities conducted by TECs? This report attempts to answer this question through legal research and analysis based on a review of laws in the seven selected states. For the purposes of this report, every state and tribal government is assumed to have some general public health legal authority to acquire and